base/frameworks/control/main.bro

Control

The control framework provides the foundation for providing “commands” that can be taken remotely at runtime to modify a running Bro instance or collect information from the running instance.

Namespace:Control Source File:/scripts/base/frameworks/control/main.bro

Summary

Redefinable Options

Control::arg: string &redef	This can be used by commands that take an argument.
Control::cmd: string &redef	The command that is being done.
Control::commands: set &redef	The commands that can currently be given on the command line for remote control.
Control::controllee_listen: bool &redef	Whether the controllee should call Broker::listen.
Control::host: addr &redef	The address of the host that will be controlled.
Control::host_port: port &redef	The port of the host that will be controlled.
Control::zone_id: string &redef	If Control::host is a non-global IPv6 address and requires a specific RFC 4007 zone_id, it can be set here.

Constants

Control::ignore_ids: set	Variable IDs that are to be ignored by the update process.
Control::topic_prefix: string	The topic prefix used for exchanging control messages via Broker.

Events

Control::configuration_update: event	This event is a wrapper and alias for the Control::configuration_update_request event.
Control::configuration_update_request: event	Inform the remote Bro instance that it’s configuration may have been updated.
Control::configuration_update_response: event	Message in response to a configuration update request.
Control::id_value_request: event	Event for requesting the value of an ID (a variable).
Control::id_value_response: event	Event for returning the value of an ID after an Control::id_value_request event.
Control::net_stats_request: event	Requests the current net_stats.
Control::net_stats_response: event	Returns the current net_stats.
Control::peer_status_request: event	Requests the current communication status.
Control::peer_status_response: event	Returns the current communication status.
Control::shutdown_request: event	Requests that the Bro instance begins shutting down.
Control::shutdown_response: event	Message in response to a shutdown request.

Detailed Interface

Redefinable Options

Control::arg

Type:string Attributes:&redef Default:""

This can be used by commands that take an argument.

Control::cmd

Type:string Attributes:&redef Default:""

The command that is being done. It’s typically set on the command line.

Control::commands

Type:set [string] Attributes:&redef Default:

{
   "shutdown",
   "net_stats",
   "peer_status",
   "id_value",
   "configuration_update"
}

The commands that can currently be given on the command line for remote control.

Control::controllee_listen

Type:bool Attributes:&redef Default:T

Whether the controllee should call Broker::listen. In a cluster, this isn’t needed since the setup process calls it.

Control::host

Type:addr Attributes:&redef Default:0.0.0.0

The address of the host that will be controlled.

Control::host_port

Type:port Attributes:&redef Default:0/tcp

The port of the host that will be controlled.

Control::zone_id

Type:string Attributes:&redef Default:""

If Control::host is a non-global IPv6 address and requires a specific RFC 4007 zone_id, it can be set here.

Constants

Control::ignore_ids

Type:set [string] Default:{}

Variable IDs that are to be ignored by the update process.

Control::topic_prefix

Type:string Default:"bro/control"

The topic prefix used for exchanging control messages via Broker.

Events

Control::configuration_update

Type:event ()

This event is a wrapper and alias for the Control::configuration_update_request event. This event is also a primary hooking point for the control framework.

Control::configuration_update_request

Type:event ()

Inform the remote Bro instance that it’s configuration may have been updated.

Control::configuration_update_response

Type:event ()

Message in response to a configuration update request.

Control::id_value_request

Type:event (id: string)

Event for requesting the value of an ID (a variable).

Control::id_value_response

Type:event (id: string, val: string)

Event for returning the value of an ID after an Control::id_value_request event.

Control::net_stats_request

Type:event ()

Requests the current net_stats.

Control::net_stats_response

Type:event (s: string)

Returns the current net_stats.

Control::peer_status_request

Type:event ()

Requests the current communication status.

Control::peer_status_response

Type:event (s: string)

Returns the current communication status.

Control::shutdown_request

Type:event ()

Requests that the Bro instance begins shutting down.

Control::shutdown_response

Type:event ()

Message in response to a shutdown request.